Security researchers have warned developers not to run AI coding agents from their Downloads folder, after finding that a plain-text instruction file left there can steer the agent into installing malicious software or exposing its login credentials.

The finding, reported by BleepingComputer on 25 October 2026, comes from Forever Security, which monitors risks introduced by AI agents. The company found a malicious AGENTS.md file in a customer's Downloads folder, which was also the agent's working directory. The agent attempted to install the malicious npm package function-color, and Forever Security says it stopped the attempt before code ran. How the file reached the customer's machine could not be determined.

Why the Downloads folder is special

AGENTS.md and CLAUDE.md files tell a coding agent which tools to use, how to run tests and which conventions to follow. Agents load applicable files from their working directory automatically, so instructions in them are acted on with the agent's own tools and permissions. Downloads is unusual because a website can write there on its own, with browsers saving downloads there without asking where.

What the lab tests showed

In controlled tests, a Codex attack path that changed the agent's machine-wide settings succeeded in more than 90% of attempts with a harmless payload, according to the researchers. A separate Claude Code path, using a crafted CLAUDE.md file that redirected API traffic to a researcher-controlled server, exposed an OAuth token and enabled code execution in roughly 50% of tests. The researchers stress there is nothing for OpenAI or Anthropic to patch in the usual sense, because an agent following the instruction file in its folder is doing what it was built to do. Their advice: work only in a narrow project directory, inspect unfamiliar instruction files, and never launch an agent from Downloads.